@hawkeyexl/manni 2.0.1 → 2.2.0

package/dist/index.d.ts

@@ -402,6 +402,126 @@ interface ConfigFile {
     encryptionKeyPrevious?: string;
 }
 
+/** Lines as an entry writes them: an integer for one line, `"L1-L2"` for several. */
+type LineSpec = number | string;
+/** Page lines as an editor numbers them, 1-based and inclusive. */
+interface PageLines {
+    start: number;
+    end: number;
+}
+/** A 1-based inclusive range, either end optional: no `start` is the whole text, no `end` one line. */
+interface LineRange {
+    start?: number;
+    end?: number;
+}
+/** BOM stripped, CRLF folded to LF. */
+declare function normalizeText(text: string): string;
+/** The normalized lines, without the empty element a trailing LF leaves. */
+declare function splitLines(text: string): string[];
+/**
+ * The pin of already-joined lines: `sha256-<hex>`, or with `key` the
+ * `hmac-sha256-<hex>` keyed pin an encrypted value carries. A plain pin
+ * passes `undefined`.
+ */
+declare function hashLines(joined: string, key?: string): string;
+/** Whether a pin is keyed (`hmac-sha256-`), the form an encrypted value carries. */
+declare function isKeyedPin(pin: string): boolean;
+/** The plain pin of a range of lines; undefined when the range falls outside them or ends before it starts. */
+declare function pinOfLines(lines: readonly string[], range: PageLines): string | undefined;
+/** Half-width of the band around the original position the blind move search tries first. */
+declare const MOVE_WINDOW_LINES = 2000;
+/** Default hashing budget for the blind move search, in bytes. */
+declare const MOVE_BUDGET_BYTES: number;
+/** The widest range a move search is attempted for. */
+declare const MAX_RANGE_LINES = 5000;
+interface FindWindowsOptions {
+    /** The 1-based start line the range was pinned at: the blind search begins around it. */
+    around?: number;
+    /** The pinned lines as they were, when known: enables the first-line filter. */
+    original?: readonly string[];
+    /** Hashing budget for the blind search, in bytes. Default `MOVE_BUDGET_BYTES`. */
+    budget?: number;
+}
+/**
+ * Pure move search over normalized lines: the 1-based start lines where a
+ * window of `length` lines hashes to `pin`. `original` (the pinned lines as
+ * they were, when known) enables the first-line filter. `key` keys the hash
+ * for a keyed pin and is `undefined` for a plain one.
+ */
+declare function findWindows(lines: readonly string[], length: number, pin: string, key: string | undefined, opts?: FindWindowsOptions): {
+    starts: number[];
+    truncated: boolean;
+};
+/**
+ * The lines a `LineSpec` names. Undefined for a value that is neither a
+ * positive integer nor `"L1-L2"` with `L1 <= L2`.
+ */
+declare function parseLines(spec: LineSpec): PageLines | undefined;
+/** Lines as an entry writes them: the integer for one line, `"L1-L2"` otherwise. */
+declare function lineSpec(lines: PageLines): LineSpec;
+/** Lines as a report spells them: `"9"` or `"9-12"`. */
+declare function spellLines(lines: PageLines): string;
+/** Body lines as file lines: body line 1 is the file line `bodyLine`, the first after the frontmatter. */
+declare function toFileLines(lines: PageLines, bodyLine: number): PageLines;
+/** File lines as body lines. */
+declare function toBodyLines(lines: PageLines, bodyLine: number): PageLines;
+
+/** One `provenance` entry as stored: body lines, and the pin over them. */
+interface ProvenanceEntry {
+    "generated-by": string;
+    lines: LineSpec;
+    integrity: string;
+}
+/** A page read for provenance. */
+interface ProvenancePage {
+    /** Every normalized line of the file. */
+    lines: string[];
+    /** The file line body line 1 sits on. */
+    bodyLine: number;
+    /** The body's lines: `lines` from `bodyLine` on. */
+    body: string[];
+    /** The well-formed `provenance` entries the frontmatter carries. */
+    stamp: ProvenanceEntry[];
+}
+/** Which of 0046's five evidence rules answered for a line. */
+type EvidenceRule = 1 | 2 | 3 | 4 | 5;
+/** A line's evidence: the machine, or none under rule 5, and the blamed sha. */
+interface LineEvidence {
+    machine?: string;
+    rule: EvidenceRule;
+    sha: string;
+}
+/** One derived range: its entry, its body lines, and its first line's evidence. */
+interface DerivedRange {
+    entry: ProvenanceEntry;
+    span: PageLines;
+    evidence: LineEvidence;
+}
+/** A page's derivation: the page, each body line's evidence, and the ranges. */
+interface ProvenanceDerivation {
+    page: ProvenancePage;
+    evidenceByLine: ReadonlyMap<number, LineEvidence>;
+    derived: DerivedRange[];
+}
+/** 0046's comparison verdicts. */
+type ProvenanceStatus = "current" | "moved" | "changed" | "stale" | "unset";
+/** One range of `DerivedField.ranges`, in file lines. */
+interface RangeResult {
+    lines: string;
+    "generated-by": string;
+    integrity: string;
+    status: ProvenanceStatus;
+    /** `uncommitted`, `blame <sha7>`, or `pin` when only the pin speaks for the range. */
+    evidence: string;
+    /** What the record said before: on `moved` and `stale` only. */
+    from?: {
+        lines: string;
+        "generated-by": string;
+    };
+    /** Whether `derive` wrote this range; always false until it does. */
+    written: boolean;
+}
+
 /**
  * The derived metadata channel: values computed from git history, CODEOWNERS
  * and the review record on GitHub or GitLab rather than written by hand.
@@ -415,11 +535,11 @@ interface ConfigFile {
  * one, and turning the stale comparisons into findings.
  */
 
-/** The six built-in fields, in the order messages list them. */
-declare const DERIVABLE_FIELDS: readonly ["created", "last-updated", "authors", "owner", "reviewed-by", "last-reviewed"];
+/** The seven built-in fields, in the order messages list them. */
+declare const DERIVABLE_FIELDS: readonly ["created", "last-updated", "authors", "owner", "reviewed-by", "last-reviewed", "provenance"];
 type BuiltinDerivableField = (typeof DERIVABLE_FIELDS)[number];
 /**
- * A managed field name: one of the six built-ins, or a key with an entry in
+ * A managed field name: one of the seven built-ins, or a key with an entry in
  * `derive.commands`. The config parser guarantees one or the other.
  */
 type DerivableField = string;
@@ -500,6 +620,32 @@ interface DeriveInput {
     absPath: string;
     content: string;
     extracted: ExtractedMetadata;
+    /**
+     * Where the page's `provenance` record lives when a manifest owns it
+     * (proposal 0046), so evidence rule 2 reads the manifest's blob at each
+     * commit rather than the page's frontmatter. Absent: the page's own.
+     */
+    provenanceManifest?: ProvenanceManifestRef;
+    /**
+     * `manni meta derive <path>:L1-L2 --generated-by <name>`: the file lines
+     * each target names go to `generatedBy`, committed or not, unless evidence
+     * names another machine, and no other uncommitted line does. Ranges that
+     * overlap attribute their union. Each target is a positional as typed,
+     * which every refusal quotes.
+     */
+    attribution?: {
+        targets: string[];
+        generatedBy: string;
+    };
+}
+/** A manifest that holds one page's `provenance`, as the git source reads it at a commit. */
+interface ProvenanceManifestRef {
+    /** The manifest file, absolute. */
+    absPath: string;
+    /** The page's key there: its path relative to the config directory, or its join value. */
+    entry: string;
+    /** `path`, or the page field the manifest joins on. */
+    join: string;
 }
 /** What a derive run holds constant across every document it visits. */
 interface DeriveContext {
@@ -518,6 +664,10 @@ interface DeriveContext {
     now: () => Date;
     /** The review client for every repository in the run; the built-in `gh` / `glab` clients when absent. */
     reviews?: ReviewClient;
+    /** `--generated-by` or `MANNI_GENERATED_BY` (proposal 0046): who uncommitted body lines go to. */
+    generatedBy?: string;
+    /** `derive.machines`: trailer identities that are machines; `["*[bot]"]` when absent. */
+    machines?: readonly string[];
 }
 /**
  * How an asserted value stands against the derived one.
@@ -542,6 +692,25 @@ interface DerivedField {
     status: DerivedStatus;
     /** Whether `derive` wrote the value into the document. */
     written: boolean;
+    /**
+     * `provenance` only (proposal 0046): one verdict per range, in file lines.
+     * The field's own `status` is `current` when every range is, and
+     * otherwise `stale`, or `unset` when the page carries no record at all.
+     */
+    ranges?: RangeResult[];
+    /**
+     * `provenance` only: the manifest that holds the page's record, as the run
+     * reports it, when one does. `derive` writes there, never into the page.
+     */
+    manifest?: string;
+    /**
+     * Proposal 0047: the manifest a field other than `provenance` is written
+     * into, as the run reports it, when a manifest of the page's collections
+     * owns the key. Absent when the value goes to the page.
+     */
+    destination?: string;
+    /** The 1-based line of the key in `destination` after the write. Absent under `dryRun` and `check`. */
+    destinationLine?: number;
 }
 /**
  * The `schema` ref a stale-field finding carries, and so its baseline and
@@ -567,9 +736,14 @@ declare function compareDerived(field: DerivableField, asserted: unknown, derive
  * field that is `stale` or `unset`. Current and unknown fields file nothing.
  *
  * `lineFor` is the document's own pointer lookup, so a finding lands on the
- * line the asserted key sits on; an unset field has no line.
+ * line the asserted key sits on; an unset field has no line. `locate` answers
+ * for a value a manifest supplied (proposal 0047): the finding then names the
+ * manifest and its line, as every other manifest finding does.
  */
-declare function staleFindings(fields: readonly DerivedField[], lineFor: (pointer: string) => number | undefined): FieldError[];
+declare function staleFindings(fields: readonly DerivedField[], lineFor: (pointer: string) => number | undefined, locate?: (pointer: string) => {
+    file: string;
+    line?: number;
+} | undefined): FieldError[];
 
 interface SchemaOverride {
     /**
@@ -708,6 +882,14 @@ interface DeriveConfig {
      * is never a built-in field, `$schema`, or a key a manifest owns.
      */
     commands?: Record<string, DeriveCommandConfig>;
+    /**
+     * Trailer identities that are machines (proposal 0046), as globs matched
+     * case-sensitively against a trailer's name and its email, with literal
+     * brackets. A match names a machine for `provenance` and is left out of
+     * `authors`. Absent means `["*[bot]"]`, which is 0040's rule; read it
+     * through `machinesOf`.
+     */
+    machines?: string[];
 }
 /** Defaults for the `fill` command; every key is overridable by a CLI flag. */
 interface FillConfig {
@@ -1181,189 +1363,222 @@ interface GetFileResult {
      * one. A run carrying any `error` exits 1.
      */
     error?: string;
+    /**
+     * `provenance` only (proposal 0046), present when it was requested and the
+     * file parsed. `bodyLine` is the file line body line 1 sits on, which the
+     * record's body lines are shown against. `current` is whether the record
+     * agrees with git as `validate` judges it, range by range; absent when
+     * nothing was derived.
+     */
+    provenance?: {
+        bodyLine: number;
+        current?: boolean;
+    };
 }
 declare function runGet(opts: GetOptions): Promise<GetFileResult[]>;
 
 /** Ask a yes/no question; `true` only for a yes. */
 type Confirm = (question: string) => Promise<boolean>;
 
-interface QueryOptions {
-    /**
-     * One SQL statement. The table is `docs`; see the system columns below.
-     * May be empty when `db` is set — export without querying.
-     */
-    sql: string;
-    /**
-     * `--db`: also write the built database to this file, for any SQLite
-     * front-end (sqlite3, Datasette, duckdb) to open afterwards. The file is a
-     * regenerated artifact: an existing SQLite file at the path is overwritten,
-     * anything else is refused.
-     */
-    db?: string;
-    inputs: string[];
-    as?: string;
-    exclude?: string[];
-    exts?: string[];
-    configPath?: string;
-    /** `--no-config`: skip config discovery and use the built-in defaults. */
-    noConfig?: boolean;
-    /**
-     * `--collection <name>`, repeatable: run over the named configured
-     * collections instead of every declared one (proposal 0041). Cannot be
-     * combined with positional paths; `-` is allowed beside it.
-     */
-    collections?: string[];
-    cwd?: string;
-    /** Content for the `-` (stdin) input, injected by the CLI/tests. */
-    stdinContent?: string;
-    /** Permit an input set that resolves to zero files (see `assertNonEmpty`). */
-    allowEmpty?: boolean;
+/**
+ * The `schema` ref a collision finding carries, and so its baseline and rule
+ * identity: `external:owned/external`. Shaped like `check:<name>` so
+ * `classifyRef` passes it through as a built-in id rather than resolving it
+ * as a cwd-relative file path, and reserved in the registry for the same
+ * reason `check` is.
+ */
+declare const EXTERNAL_OWNED_SCHEMA = "external:owned";
+/**
+ * The `schema` ref of a duplicate-join finding (0039): two documents carry
+ * the same value of a join field, so one manifest entry matched both.
+ */
+declare const EXTERNAL_DUPLICATE_SCHEMA = "external:duplicate";
+/**
+ * The `keyword` every external-metadata finding carries: no Ajv keyword
+ * produced it.
+ */
+declare const EXTERNAL_KEYWORD = "external";
+/** The join that names documents by path, and the default. */
+declare const PATH_JOIN = "path";
+/** One value a manifest supplied, and where it was written. */
+interface ExternalMetadataValue {
+    value: unknown;
+    /** The collection whose manifest supplied it (proposal 0041). */
+    collection: string;
+    /** Manifest path as the run reports it: relative to the run's base, posix — or the URL. */
+    file: string;
+    /** 1-based line of the key in the manifest, when known. */
+    line?: number;
     /**
-     * `--no-gitignore` (false). Absent leaves config `respectGitignore:` in
-     * charge, which itself defaults to on.
+     * 1-based manifest line of every node inside `value`, keyed by the JSON
+     * Pointer relative to `value` (`/2/source/file`). A mapping member sits on
+     * its key's line, and a list item on the line its node starts. Present only
+     * when `value` is a mapping or a list with members; `line` answers for the
+     * value itself.
      */
-    respectGitignore?: boolean;
-    /** Diagnostics for the user; the CLI writes these to stderr. */
-    onNotice?: (message: string) => void;
-    /** Called once when a config governs the run, so the CLI can report it. */
-    onConfigLoaded?: (info: ConfigNotice) => void;
+    lines?: ReadonlyMap<string, number>;
+}
+/** One manifest entry, for the orphan checks. */
+interface ExternalMetadataEntry {
+    /** The collection whose manifest declared it (proposal 0041). */
+    collection: string;
+    /** `path`, or the frontmatter field this entry is keyed by. */
+    join: string;
+    /** Absolute document path, for a path entry. */
+    abs?: string;
+    /** The key exactly as written in the manifest. */
+    spelled: string;
+    /** Manifest path as the run reports it. */
+    file: string;
+    /** 1-based line of the entry in the manifest, when known. */
+    line?: number;
+}
+/** Every manifest of a run, loaded once and consulted per document. */
+interface ExternalMetadataIndex {
     /**
-     * `--offline`, accepted for surface parity with the other commands. DDL
-     * statements do resolve the corpus's schema set (0024), but only from disk
-     * and the bundled built-ins — a URL ref refuses with "vendor it first"
-     * before anything could fetch — so there is still no network dependency to
-     * suppress.
+     * Owned key -> every collection that owns it, with the manifest that does.
+     *
+     * A list rather than one entry, because two collections may legitimately
+     * each own the same key (0041 rule 5): `guides` and `blog` can both supply
+     * `owner`. Ambiguity only exists for a file that is a member of both, which
+     * is decided per file in `mergeExternalMetadata`.
      */
+    owners: ReadonlyMap<string, readonly {
+        collection: string;
+        file: string;
+    }[]>;
+    /** Path-joined manifests: absolute document path -> owned key -> value. */
+    byPath: ReadonlyMap<string, ReadonlyMap<string, ExternalMetadataValue>>;
+    /** Field-joined manifests: field -> value -> owned key -> value. */
+    byField: ReadonlyMap<string, ReadonlyMap<string, ReadonlyMap<string, ExternalMetadataValue>>>;
+    /** Every manifest entry, in manifest order. */
+    entries: readonly ExternalMetadataEntry[];
+}
+interface LoadExternalMetadataOptions {
+    /** Directory `externalMetadata[].file` and every manifest key resolve from. */
+    configDir: string;
+    /** Directory the run's file labels are relative to; manifests are reported the same way. */
+    base: string;
+    /** `--offline` / `offline:`: a URL manifest is refused rather than fetched (0038). */
     offline?: boolean;
+    /** Network timeout for a URL manifest; the schema fetch's default otherwise. */
+    timeoutMs?: number;
+    /** For tests: the environment `tokenEnv` is read from. */
+    env?: Record<string, string | undefined>;
+}
+/** A place a merged value lives, for a finding that must name it. */
+interface SourceLocation {
+    file: string;
+    line?: number;
+    col?: number;
+}
+/** A key the document carries that a manifest owns. */
+interface ExternalMetadataCollision {
+    key: string;
+    /** The owning manifest, as the run reports it. */
+    file: string;
+    /** The collection that manifest belongs to (proposal 0041). */
+    collection: string;
+}
+/** A field-joined entry a document matched (0039). */
+interface ExternalMetadataJoin {
+    field: string;
+    /** The value matched: the field's plaintext, decrypted first when the page holds it encrypted. */
+    value: string;
     /**
-     * `--no-cache` (false): ask GitHub or GitLab again rather than reading the
-     * review cache. Only a statement naming the `derived` table consults it,
-     * and only for `reviewed-by` and `last-reviewed`; absent leaves it on.
+     * The field as the page holds it, when that differs from `value`: the
+     * ciphertext of an encrypted join field (proposal 0045). A finding about
+     * the join names this, never the plaintext.
      */
-    cache?: boolean;
+    pageValue?: string;
+    /** The manifest, as the run reports it. */
+    file: string;
+    /** The collection that manifest belongs to (proposal 0041). */
+    collection: string;
+}
+/** What `mergeExternalMetadata` hands back. */
+interface MergedMetadata {
+    /** The document's metadata with every owned key the manifest supplied. */
+    extracted: ExtractedMetadata;
     /**
-     * `--dry-run`: preview the statement's per-file changes — the diff it
-     * would make, files untouched. Without it a mutating statement applies,
-     * matching `fill`'s convention (proposal 0025; 0022 recorded the original
-     * preview-by-default surface this revises).
+     * Owned keys the document itself also carried, in document order, each
+     * with the manifest that owns it — so the finding names it without a
+     * second lookup, and without a fallback for an index that is not there.
      */
-    dryRun?: boolean;
+    collisions: ExternalMetadataCollision[];
+    /** Field-joined entries this document matched, one per manifest at most. */
+    joins: ExternalMetadataJoin[];
     /**
-     * Values for the statement's named parameters (`$name`, `:name`, `@name`),
-     * keyed by bare name (a `$`/`:`/`@` prefix on a key is tolerated). Each
-     * value passes through the same `bindValue` the projection loader uses —
-     * booleans become 1/0, arrays and objects JSON text — so a bound parameter
-     * compares against a stored cell under exactly the encoding the cell got
-     * (proposal 0029). A parameter the SQL references with no entry here
-     * refuses: unbound would silently bind NULL and match nothing.
-     */
-    params?: Record<string, unknown>;
-    /**
-     * `-s/--schema`, repeatable: the schema set the run's DDL evolves — CLI
-     * precedence for the DDL planner *only* (proposal 0030). The per-file
-     * resolution walk is skipped and the deduped refs are the set; every guard
-     * inside the set (single local file for ADD, sole declarer for
-     * DROP/RENAME, builtin fork, URL refusal, the trust boundary) runs
-     * unchanged. Collection views keep following the config's resolution. A
-     * run whose statement produces no DDL effect refuses before anything is
-     * applied — a flag that would silently mean nothing must refuse.
-     */
-    schemas?: string[];
-    /**
-     * How to ask for a new encryption key when an `UPDATE` or `INSERT` writes
-     * a column its schema marks `x-manni-encrypt` and no key is available
-     * (proposal 0045). The CLI passes `terminalConfirm()`, which is
-     * `undefined` off a terminal; absent, such a write refuses (exit 2). A dry
-     * run never asks: it writes nothing.
-     */
-    confirm?: Confirm;
-    /**
-     * The environment `MANNI_ENCRYPTION_KEY` is read from. Defaults to
-     * `process.env`; tests pass their own.
+     * Where a merged pointer's value lives. Answers only for a value the
+     * manifest supplied — a bare key or its `/key` pointer, and anything
+     * beneath it — and `undefined` for everything the document owns, which is
+     * what `lineFor` is for.
+     *
+     * The line is the deepest manifest node the pointer reaches, so
+     * `/citations/2` is the third item's line and `/citations/2/source/file`
+     * that member's. A pointer past what the manifest holds falls back to the
+     * nearest ancestor that exists, and at worst to the owned key's line.
      */
-    env?: NodeJS.ProcessEnv;
-    /** The clock an uncommitted body change is dated by. Test seam; default `new Date()`. */
-    now?: () => Date;
+    locate: (pointer: string) => SourceLocation | undefined;
 }
+/** The join an external-metadata config asks for: `path` unless it names a field. */
+declare function externalMetadataJoin(manifest: Pick<ExternalMetadataConfig, "join">): string;
 /**
- * One thing a statement changed, in file-space terms. Cell-level kinds carry
- * a `key` (a set, a deletion via `SET k = NULL` / `ALTER DROP COLUMN`, or a
- * key rename); file-level kinds carry the whole event (`cleared` — the block
- * stripped by DELETE; `created` — a file INSERT made; `renamed` — a `_path`
- * move). Exactly one kind per object.
+ * Load every manifest of every collection the run covers. Resolves to `null`
+ * when none of them declares one, which is every setup that existed before
+ * this feature.
+ *
+ * Every refusal is a `DocmetaError`: the manifest is a config-supplied input,
+ * and one that is missing or misshapen is the run's problem, not a
+ * document's (0014).
  */
-type QueryChange = {
-    file: string;
-    written: boolean;
-} & ({
-    key: string;
-    from: unknown;
-    to: unknown;
-} | {
-    key: string;
-    from: unknown;
-    deleted: true;
-} | {
-    key: string;
-    renamedFrom: string;
-    to: unknown;
-} | {
-    cleared: true;
-    from: Record<string, unknown>;
-} | {
-    created: true;
-    to: Record<string, unknown>;
-} | {
-    renamed: string;
-} | {
-    /** A DDL statement edited the schema itself (0024): `file` is the
-     * schema written — an in-place edit, or the fork of a builtin. */
-    schema: true;
-    op: "add" | "drop" | "rename";
-    key: string;
-    renamedTo?: string;
-    type?: string;
-    /** 0028: a declared type equal to a format name carries the format. */
-    format?: string;
-    /** 0028: a `CHECK (k IN (…))` on the added column carries the enum. */
-    enum?: (string | number)[];
-    required?: boolean;
-    forkedFrom?: string;
-} | {
-    /** A DDL side effect on the governing config file: a fork repoints the
-     * `schemas:` entry (`key: "schemas"`), an in-place edit of a pinned
-     * schema refreshes its pin (`key: "integrity"`). Disclosed as a change
-     * because the preview must name every file `--write` will touch. */
-    config: true;
-    key: string;
-    from: unknown;
-    to: unknown;
-});
-interface QueryRun {
-    /** Result column names, in SELECT order — present even for zero rows. */
-    columns: string[];
-    rows: Record<string, unknown>[];
-    /** Set when `db` was written: where, and how big the table is. */
-    db?: {
-        path: string;
-        files: number;
-        columns: number;
-    };
-    /**
-     * Present when the statement was a metadata edit: every cell it changed
-     * (empty when a mutating statement matched nothing). Absent on reads.
-     */
-    changes?: QueryChange[];
-    /**
-     * Where the run stood, in the same shape `ValidateRun.frame` carries — the
-     * path-normalization frame SARIF and JUnit need before they can name a file
-     * the way the repository does (proposal 0026). Constructed from the run's
-     * `cwd`, its config directory, and the directory file labels resolve
-     * against; absent only when a caller built a `QueryRun` by hand.
-     */
-    frame?: FingerprintContext;
-}
-declare function runQuery(opts: QueryOptions): Promise<QueryRun>;
+declare function loadExternalMetadata(collections: readonly CollectionConfig[], opts: LoadExternalMetadataOptions): Promise<ExternalMetadataIndex | null>;
+/**
+ * Merge the external metadata for one document into its extracted metadata.
+ *
+ * `label` is the document as the run spells it, relative to `base`; a path
+ * entry matches on the resolved absolute path, never on the spelling, so a
+ * positional run from a subdirectory finds the same entry a config-corpus
+ * run does. A field entry matches on the document's own value of the join
+ * field, wherever the document lives. Stdin never matches a path entry:
+ * there is no file behind it.
+ *
+ * `memberOf` names the collections this document belongs to, and only their
+ * manifests are consulted (0041 rule 4). It is the caller's `memberOf(...)`
+ * result, computed once per file.
+ *
+ * `present`, `format` and the document's own positions are untouched. A
+ * manifest key is not in the document, so `lineFor` keeps answering
+ * `undefined` for it, and `locate` answers instead.
+ *
+ * A join field the page holds encrypted (proposal 0045) is decrypted with
+ * `options.encryptionKey` before it is matched. With no key, and a manifest
+ * of this document's collections joining on that field, the run cannot match
+ * and refuses. A ciphertext that does not decrypt matches nothing.
+ */
+declare function mergeExternalMetadata(label: string, extracted: ExtractedMetadata, index: ExternalMetadataIndex | null, memberOf: readonly string[], base: string, options?: {
+    encryptionKey?: () => string | undefined;
+}): MergedMetadata;
+/** The `/key` pointer for an external-metadata finding, RFC 6901 escaped. */
+declare function externalMetadataPointer(key: string): string;
+/**
+ * Path entries naming no loaded document.
+ *
+ * `loaded` are the run's file labels, relative to `base`. Checked only when
+ * the run is the config corpus (the same invariant corpus checks use): a
+ * positional path means the operator chose to look at part of the corpus,
+ * and an entry for the rest is expected, not orphaned.
+ */
+declare function orphanEntries(index: ExternalMetadataIndex | null, loaded: readonly string[], base: string, collections?: readonly string[]): ExternalMetadataEntry[];
+/**
+ * Field entries no loaded document matched (0039). `matched` is field -> the
+ * values documents in the run carried, which the caller collects from each
+ * document's `joins` — so this runs after the per-file loop, under the same
+ * corpus invariant as `orphanEntries`.
+ */
+declare function orphanJoins(index: ExternalMetadataIndex | null, matched: ReadonlyMap<string, ReadonlySet<string>>, collections?: readonly string[]): ExternalMetadataEntry[];
+/** The operational error an orphan check raises, naming the first entry. */
+declare function orphanError(orphans: readonly ExternalMetadataEntry[]): DocmetaError;
 
 interface BuiltinInfo {
     id: string;
@@ -1477,21 +1692,400 @@ declare function fetchSchemaBytes(ref: string, options?: LoadSchemaOptions): Pro
 declare function schemaLoadOptions(args: {
     root: string;
     /**
-     * Where a relative local-file schema ref is measured from — the run's `cwd`,
-     * not `root`. The two differ when a config was discovered in an ancestor, and
-     * a `--schema ./x.json` typed on the command line belongs to the directory
-     * the user was standing in, not to the config's.
+     * Where a relative local-file schema ref is measured from — the run's `cwd`,
+     * not `root`. The two differ when a config was discovered in an ancestor, and
+     * a `--schema ./x.json` typed on the command line belongs to the directory
+     * the user was standing in, not to the config's.
+     */
+    fileBase?: string;
+    /** Config `schemaCache.ttlHours`. */
+    ttlHours?: number;
+    /** `--offline`, else config `offline:`. */
+    offline?: boolean;
+    /** From `collectSchemaPins(config)`; omitted when the config pins nothing. */
+    pins?: ReadonlyMap<string, SchemaPin>;
+}): LoadSchemaOptions;
+/** Load and return the JSON Schema object for a reference. */
+declare function loadSchema(ref: string, options?: LoadSchemaOptions): Promise<Record<string, unknown>>;
+
+/**
+ * `x-manni-location` (proposal 0047): where a schema would like a top-level
+ * key's value stored, on the page or in external metadata.
+ *
+ * The keyword is registered on every Ajv meta builds (validator.ts), next to
+ * `x-manni-encrypt`, and like it records where it was evaluated. Ajv's own
+ * resolution is the walker, so a mark counts through `$ref`, `allOf` and a
+ * referenced built-in, and inside the `anyOf`, `oneOf` and `if`/`then`
+ * branches Ajv takes. Only top-level properties carry a preference; a nested
+ * mark is accepted and ignored. `Validator.locationPreferences` is the one
+ * question commands ask of it.
+ *
+ * One schema marking one key both ways is judged twice. Through `properties`,
+ * `allOf` and local `$ref` alone, it is refused when the schema compiles.
+ * Across conditional branches it is not an error: Ajv evaluates failing
+ * branches too, so that schema gives the key no preference.
+ */
+/** The schema keyword. */
+declare const LOCATION_KEYWORD = "x-manni-location";
+/** Where a top-level key prefers to live. */
+type FieldLocation = "page" | "external";
+/** A key's preferred location, and the schema ref whose mark decided it. */
+interface LocationPreference {
+    location: FieldLocation;
+    /** The ref, as given to `locationPreferences`, whose mark won. */
+    schema: string;
+}
+
+declare class Validator {
+    private readonly schemaOptions;
+    /**
+     * How this validator's schemas are loaded: the disk cache location, its TTL,
+     * and `--offline`. Held per instance rather than read from module state, so
+     * two differently-configured validations in one process each get their own
+     * settings.
+     *
+     * That is not full isolation, and the difference matters to a library
+     * caller: `schema-registry` keeps a process-wide memo of fetched schemas, so
+     * one validator's successful fetch is visible to another. `offline` is
+     * excluded from that sharing on purpose — an offline validator will not be
+     * served something this process pulled over the network — but the memo is
+     * still shared, so a URL fetched once is not re-fetched per instance.
+     */
+    constructor(schemaOptions?: LoadSchemaOptions);
+    private ajvByDialect;
+    /**
+     * Keyed on the in-flight *promise*, not the resolved validator. Caching the
+     * result made this a check-then-act race: `fill` walks files through a worker
+     * pool, so every worker missed the cache while the first `loadSchema` was
+     * still pending and they all then compiled the same schema into the one
+     * shared per-dialect Ajv. Ajv registers a schema's `$id` on the first compile
+     * and rejects the second with "schema with key or id ... already exists",
+     * which took down any multi-file run against an $id-bearing schema. Storing
+     * the promise before the first await lets the losers await the one compile.
+     */
+    private cache;
+    private ajvFor;
+    /**
+     * Synchronous by design: the `cache.set` has to happen in the same tick as
+     * the miss, or a second caller can slip in before the entry exists.
+     */
+    private compile;
+    private compileUncached;
+    /**
+     * The instance pointers of `data` that carry `x-manni-encrypt: true` under
+     * any schema in `refs`, in the order the validator evaluated them.
+     *
+     * A first pass with the recording keyword, so a mark counts exactly where
+     * validation would evaluate it. Only present values are marked: Ajv applies
+     * a property's subschema to a property that exists. A branch Ajv does not
+     * take (`then` behind a failing `if`, an `anyOf` branch after a passing
+     * one) contributes nothing; a branch it takes contributes its marks
+     * whether or not the branch passes, because a ciphertext routinely fails
+     * the rest of its own subschema until it is decrypted.
+     */
+    markedPointers(data: Record<string, unknown>, refs: string[]): Promise<Set<string>>;
+    /**
+     * The location each top-level key of `data` prefers under `refs`: `page` or
+     * `external`, and the ref whose `x-manni-location` mark decided it. A key no
+     * schema marks has no entry.
+     *
+     * A first pass with the recording keyword, as `markedPointers` runs, so a
+     * mark counts exactly where validation would evaluate it, and a nested mark
+     * is ignored. Only present values are marked: Ajv applies a property's
+     * subschema to a property that exists. A caller asking where a key it is
+     * about to write belongs passes `data` that already holds the candidate
+     * value. `$schema` is stripped first, as validation does.
+     *
+     * Refs are evaluated in order and a later ref's mark wins. A ref that says
+     * both values for one key unconditionally is refused when it compiles; one
+     * whose evaluated branches say both gives that key no preference.
+     */
+    locationPreferences(data: Record<string, unknown>, refs: string[]): Promise<Map<string, LocationPreference>>;
+    /**
+     * Validate `data` against every schema in `refs`. Returns all violations,
+     * each tagged with the schema that produced it and a source line via
+     * `lineFor`.
+     *
+     * `colFor` is optional and additive: this signature is public, so a fourth
+     * *required* parameter — or a widened third one — would be a consumer break.
+     * Callers with an extractor that supplies no column pass nothing and get the
+     * previous behavior exactly.
+     */
+    validate(data: Record<string, unknown>, refs: string[], lineFor: (pointer: string) => number | undefined, colFor?: (pointer: string) => number | undefined, 
+    /**
+     * Where a merged value lives when it is not in the document (proposal
+     * 0037): a manifest's file and line. Consulted before `lineFor`,
+     * and additive in the way `colFor` was.
+     */
+    locate?: (pointer: string) => SourceLocation | undefined): Promise<FieldError[]>;
+}
+
+/** Why a value was moved: its schema's mark, or a manifest that already owns the key. */
+type RelocateMoveReason = "preferred" | "owned";
+/** Why a value stayed on the side it is on. */
+type RelocateStayReason = "no-home" | "read-only-format" | "no-join-value" | "values-differ" | "url-manifest" | "unreadable";
+/** One value that moved, or would under `dryRun`. */
+type RelocateMove = {
+    key: string;
+    to: "page";
+    from: string;
+    reason: RelocateMoveReason;
+} | {
+    key: string;
+    to: "manifest";
+    manifest: string;
+    /** 1-based line of the key in the manifest afterwards. Absent under `dryRun`. */
+    line?: number;
+    reason: RelocateMoveReason;
+};
+/** One value that stayed on the wrong side. */
+interface RelocateStay {
+    key: string;
+    reason: RelocateStayReason;
+    /** The sentence the pretty reporter prints after `stays: `. Not part of the JSON shape. */
+    detail?: string;
+}
+interface RelocateFileResult {
+    /** The page, as the run labels it. */
+    file: string;
+    moved: RelocateMove[];
+    stayed: RelocateStay[];
+    /** A member page outside the paths the run named, reached through a `keys:` or `paths:` change. */
+    beyond: boolean;
+}
+interface RelocateManifestResult {
+    /** The manifest as the run reports it: relative to the run's base, or the URL. */
+    file: string;
+    collection: string;
+    /** Its index in the collection's `externalMetadata:` before the run. */
+    index: number;
+    created: boolean;
+    keysAdded: string[];
+    keysRemoved: string[];
+    /** The keys it owns afterwards. */
+    keys: string[];
+    /** Whether its last key went, so the config no longer declares it (R3). */
+    undeclared: boolean;
+    /** Pages beyond the named paths whose values a `keys:` change moves, or leaves. */
+    beyond: number;
+}
+interface RelocateConfigResult {
+    /** The config file relative to the working directory, or null when there is none and none was needed. */
+    file: string | null;
+    created: boolean;
+    collectionsCreated: {
+        name: string;
+        paths: string[];
+    }[];
+    pathsAdded: {
+        collection: string;
+        path: string;
+    }[];
+}
+interface RelocateSummary {
+    /** Pages with a value moved or stayed. */
+    files: number;
+    moved: number;
+    stayed: number;
+    manifestsCreated: number;
+}
+interface RelocateResult {
+    dryRun: boolean;
+    config: RelocateConfigResult;
+    /** Every manifest the run creates, changes the keys of, or moves a value into or out of. */
+    manifests: RelocateManifestResult[];
+    files: RelocateFileResult[];
+    summary: RelocateSummary;
+}
+
+interface QueryOptions {
+    /**
+     * One SQL statement. The table is `docs`; see the system columns below.
+     * May be empty when `db` is set — export without querying.
+     */
+    sql: string;
+    /**
+     * `--db`: also write the built database to this file, for any SQLite
+     * front-end (sqlite3, Datasette, duckdb) to open afterwards. The file is a
+     * regenerated artifact: an existing SQLite file at the path is overwritten,
+     * anything else is refused.
+     */
+    db?: string;
+    inputs: string[];
+    as?: string;
+    exclude?: string[];
+    exts?: string[];
+    configPath?: string;
+    /** `--no-config`: skip config discovery and use the built-in defaults. */
+    noConfig?: boolean;
+    /**
+     * `--collection <name>`, repeatable: run over the named configured
+     * collections instead of every declared one (proposal 0041). Cannot be
+     * combined with positional paths; `-` is allowed beside it.
+     */
+    collections?: string[];
+    cwd?: string;
+    /** Content for the `-` (stdin) input, injected by the CLI/tests. */
+    stdinContent?: string;
+    /** Permit an input set that resolves to zero files (see `assertNonEmpty`). */
+    allowEmpty?: boolean;
+    /**
+     * `--no-gitignore` (false). Absent leaves config `respectGitignore:` in
+     * charge, which itself defaults to on.
+     */
+    respectGitignore?: boolean;
+    /** Diagnostics for the user; the CLI writes these to stderr. */
+    onNotice?: (message: string) => void;
+    /** Called once when a config governs the run, so the CLI can report it. */
+    onConfigLoaded?: (info: ConfigNotice) => void;
+    /**
+     * `--offline`, accepted for surface parity with the other commands. DDL
+     * statements do resolve the corpus's schema set (0024), but only from disk
+     * and the bundled built-ins — a URL ref refuses with "vendor it first"
+     * before anything could fetch — so there is still no network dependency to
+     * suppress.
+     */
+    offline?: boolean;
+    /**
+     * `--no-cache` (false): ask GitHub or GitLab again rather than reading the
+     * review cache. Only a statement naming the `derived` table consults it,
+     * and only for `reviewed-by` and `last-reviewed`; absent leaves it on.
+     */
+    cache?: boolean;
+    /**
+     * `--dry-run`: preview the statement's per-file changes — the diff it
+     * would make, files untouched. Without it a mutating statement applies,
+     * matching `fill`'s convention (proposal 0025; 0022 recorded the original
+     * preview-by-default surface this revises).
+     */
+    dryRun?: boolean;
+    /**
+     * Values for the statement's named parameters (`$name`, `:name`, `@name`),
+     * keyed by bare name (a `$`/`:`/`@` prefix on a key is tolerated). Each
+     * value passes through the same `bindValue` the projection loader uses —
+     * booleans become 1/0, arrays and objects JSON text — so a bound parameter
+     * compares against a stored cell under exactly the encoding the cell got
+     * (proposal 0029). A parameter the SQL references with no entry here
+     * refuses: unbound would silently bind NULL and match nothing.
+     */
+    params?: Record<string, unknown>;
+    /**
+     * `-s/--schema`, repeatable: the schema set the run's DDL evolves — CLI
+     * precedence for the DDL planner *only* (proposal 0030). The per-file
+     * resolution walk is skipped and the deduped refs are the set; every guard
+     * inside the set (single local file for ADD, sole declarer for
+     * DROP/RENAME, builtin fork, URL refusal, the trust boundary) runs
+     * unchanged. Collection views keep following the config's resolution. A
+     * run whose statement produces no DDL effect refuses before anything is
+     * applied — a flag that would silently mean nothing must refuse.
+     */
+    schemas?: string[];
+    /**
+     * How to ask for a new encryption key when an `UPDATE` or `INSERT` writes
+     * a column its schema marks `x-manni-encrypt` and no key is available
+     * (proposal 0045). The CLI passes `terminalConfirm()`, which is
+     * `undefined` off a terminal; absent, such a write refuses (exit 2). A dry
+     * run never asks: it writes nothing.
+     */
+    confirm?: Confirm;
+    /**
+     * Called with relocate's result when a write's P1 offer was accepted and
+     * the values moved (proposal 0047), so the CLI can print relocate's report.
+     */
+    onRelocated?: (result: RelocateResult) => void;
+    /**
+     * The environment `MANNI_ENCRYPTION_KEY` is read from. Defaults to
+     * `process.env`; tests pass their own.
+     */
+    env?: NodeJS.ProcessEnv;
+    /** The clock an uncommitted body change is dated by. Test seam; default `new Date()`. */
+    now?: () => Date;
+}
+/**
+ * One thing a statement changed, in file-space terms. Cell-level kinds carry
+ * a `key` (a set, a deletion via `SET k = NULL` / `ALTER DROP COLUMN`, or a
+ * key rename); file-level kinds carry the whole event (`cleared` — the block
+ * stripped by DELETE; `created` — a file INSERT made; `renamed` — a `_path`
+ * move). Exactly one kind per object.
+ *
+ * `manifest` (proposal 0047) names the external-metadata manifest the change
+ * lands in, as the run reports it, when it lands in one: an owned key's set,
+ * removal or rename, a created file's owned keys, a stripped document's
+ * entry, or a moved document's entry.
+ */
+type QueryChange = {
+    file: string;
+    written: boolean;
+    manifest?: string;
+} & ({
+    key: string;
+    from: unknown;
+    to: unknown;
+} | {
+    key: string;
+    from: unknown;
+    deleted: true;
+} | {
+    key: string;
+    renamedFrom: string;
+    to: unknown;
+} | {
+    cleared: true;
+    from: Record<string, unknown>;
+} | {
+    created: true;
+    to: Record<string, unknown>;
+} | {
+    renamed: string;
+} | {
+    /** A DDL statement edited the schema itself (0024): `file` is the
+     * schema written — an in-place edit, or the fork of a builtin. */
+    schema: true;
+    op: "add" | "drop" | "rename";
+    key: string;
+    renamedTo?: string;
+    type?: string;
+    /** 0028: a declared type equal to a format name carries the format. */
+    format?: string;
+    /** 0028: a `CHECK (k IN (…))` on the added column carries the enum. */
+    enum?: (string | number)[];
+    required?: boolean;
+    forkedFrom?: string;
+} | {
+    /** A DDL side effect on the governing config file: a fork repoints the
+     * `schemas:` entry (`key: "schemas"`), an in-place edit of a pinned
+     * schema refreshes its pin (`key: "integrity"`). Disclosed as a change
+     * because the preview must name every file `--write` will touch. */
+    config: true;
+    key: string;
+    from: unknown;
+    to: unknown;
+});
+interface QueryRun {
+    /** Result column names, in SELECT order — present even for zero rows. */
+    columns: string[];
+    rows: Record<string, unknown>[];
+    /** Set when `db` was written: where, and how big the table is. */
+    db?: {
+        path: string;
+        files: number;
+        columns: number;
+    };
+    /**
+     * Present when the statement was a metadata edit: every cell it changed
+     * (empty when a mutating statement matched nothing). Absent on reads.
      */
-    fileBase?: string;
-    /** Config `schemaCache.ttlHours`. */
-    ttlHours?: number;
-    /** `--offline`, else config `offline:`. */
-    offline?: boolean;
-    /** From `collectSchemaPins(config)`; omitted when the config pins nothing. */
-    pins?: ReadonlyMap<string, SchemaPin>;
-}): LoadSchemaOptions;
-/** Load and return the JSON Schema object for a reference. */
-declare function loadSchema(ref: string, options?: LoadSchemaOptions): Promise<Record<string, unknown>>;
+    changes?: QueryChange[];
+    /**
+     * Where the run stood, in the same shape `ValidateRun.frame` carries — the
+     * path-normalization frame SARIF and JUnit need before they can name a file
+     * the way the repository does (proposal 0026). Constructed from the run's
+     * `cwd`, its config directory, and the directory file labels resolve
+     * against; absent only when a caller built a `QueryRun` by hand.
+     */
+    frame?: FingerprintContext;
+}
+declare function runQuery(opts: QueryOptions): Promise<QueryRun>;
 
 interface SchemasInfo {
     builtins: BuiltinInfo[];
@@ -1598,7 +2192,55 @@ interface FilledField {
      * `x-manni-encrypt`. Absent otherwise.
      */
     encrypted?: boolean;
+    /**
+     * Proposal 0047: the manifest the value was written into, as the run
+     * reports it, when a manifest of the page's collections owns the key.
+     * Absent when the value went to the page.
+     */
+    destination?: string;
+}
+/**
+ * One `meta-provenance` entry as `fill` writes it (proposal 0046): the model,
+ * the JSON Pointers of the fields it proposed, escaped per RFC 6901, and the
+ * confidence each was written at. Keys are the page's own spelling, so the
+ * JSON report shows exactly what landed in the document. An entry `fill`
+ * merged into keeps whatever else it held.
+ */
+interface MetaProvenanceEntry {
+    "generated-by": string;
+    fields: string[];
+    confidence: Record<string, number>;
+    [other: string]: unknown;
+}
+/**
+ * What became of this file's `meta-provenance` entry. It is never a failure:
+ * neither outcome changes the summary or the exit code.
+ */
+type MetaProvenanceReport = {
+    written: true;
+    entry: MetaProvenanceEntry;
+    /** The manifest the entry was written into, when one owns `meta-provenance` (0047). */
+    destination?: string;
+}
+/** The page's schemas, checked with the entry in place, reject it. */
+ | {
+    written: false;
+    skipReason: "schema-mismatch";
+}
+/** A URL manifest in one of the page's collections owns the key, and cannot be written (0047). */
+ | {
+    written: false;
+    skipReason: "manifest-owned";
+    manifest: string;
 }
+/**
+ * The format's writer cannot hold a list of entries (an HTML or XML
+ * attribute holds one line), so the fields were written without it.
+ */
+ | {
+    written: false;
+    skipReason: "unwritable";
+};
 interface FillFileResult {
     file: string;
     format: string;
@@ -1610,6 +2252,12 @@ interface FillFileResult {
     error?: string;
     /** The filled document. Populated only when the caller asks for it. */
     content?: string;
+    /**
+     * The `meta-provenance` entry recording the fields this run wrote
+     * (proposal 0046). Absent when no field was written; reported, not written,
+     * under `--dry-run`.
+     */
+    metaProvenance?: MetaProvenanceReport;
 }
 interface FillSummary {
     files: number;
@@ -1707,6 +2355,11 @@ interface FillOptions {
      * `process.env`; tests pass their own.
      */
     env?: NodeJS.ProcessEnv;
+    /**
+     * Called with relocate's result after the user accepts a P1 offer
+     * (proposal 0047), so the CLI can print what moved before the report.
+     */
+    onRelocated?: (result: RelocateResult) => void;
 }
 
 declare function runFill(opts: FillOptions): Promise<FillRun>;
@@ -1744,337 +2397,133 @@ interface DeriveOptions {
      * charge, which itself defaults to on.
      */
     respectGitignore?: boolean;
-    /** Diagnostics for the user; the CLI writes these to stderr. */
-    onNotice?: (message: string) => void;
-    /** Called once when a config governs the run, so the CLI can report it. */
-    onConfigLoaded?: (info: ConfigNotice) => void;
-    /** The clock an uncommitted body change is dated by. Test seam; default `new Date()`. */
-    now?: () => Date;
-    /** The review client, for every repository in the run. Test seam; default `gh` / `glab`. */
-    reviews?: ReviewClient;
-    /**
-     * How to ask for a new encryption key when a field its schema marks
-     * `x-manni-encrypt` is about to be stamped and no key is available
-     * (proposal 0045). The CLI passes `terminalConfirm()`, which is `undefined`
-     * off a terminal; absent, such a stamp refuses (exit 2). A dry run never
-     * asks: it writes nothing.
-     */
-    confirm?: Confirm;
-    /**
-     * The environment `MANNI_ENCRYPTION_KEY` is read from. Defaults to
-     * `process.env`; tests pass their own.
-     */
-    env?: NodeJS.ProcessEnv;
-}
-interface DeriveFileResult {
-    file: string;
-    /** Extractor/format used; `unknown` when none matched the file. */
-    format: string;
-    /** One entry per requested field, in the requested order. Empty on `error`. */
-    fields: DerivedField[];
-    /**
-     * Whether writing the stale and unset fields changed the document, or
-     * would have but for `dryRun`. Computed from the writer's output, so a
-     * patch the format serializes to the same bytes is not a change.
-     */
-    changed: boolean;
-    /** Why the file could not be derived or written; the run goes on without it. */
-    error?: string;
-    /**
-     * Under `check`, the findings for this file: one per stale or unset field,
-     * at the field's line, plus one for an `error`. Absent otherwise.
-     */
-    findings?: FieldError[];
-}
-interface DeriveSummary {
-    files: number;
-    /** Files whose document changed, or would have under `dryRun`. */
-    changed: number;
-    /** Fields whose write reached the disk: always 0 under `dryRun` and `check`. */
-    written: number;
-    stale: number;
-    unset: number;
-    unknown: number;
-    errors: number;
-}
-interface DeriveRun {
-    results: DeriveFileResult[];
-    summary: DeriveSummary;
-    dryRun: boolean;
-    check: boolean;
-    /** One status per source the run consulted; a source nobody asked for is absent. */
-    sources: Partial<Record<DeriveSource, SourceStatus$1>>;
-    /** Where the run stood, for the SARIF reporter under `check`. See `ValidateRun.frame`. */
-    frame: FingerprintContext;
-}
-declare function runDerive(opts: DeriveOptions): Promise<DeriveRun>;
-
-/**
- * The `schema` ref a collision finding carries, and so its baseline and rule
- * identity: `external:owned/external`. Shaped like `check:<name>` so
- * `classifyRef` passes it through as a built-in id rather than resolving it
- * as a cwd-relative file path, and reserved in the registry for the same
- * reason `check` is.
- */
-declare const EXTERNAL_OWNED_SCHEMA = "external:owned";
-/**
- * The `schema` ref of a duplicate-join finding (0039): two documents carry
- * the same value of a join field, so one manifest entry matched both.
- */
-declare const EXTERNAL_DUPLICATE_SCHEMA = "external:duplicate";
-/**
- * The `keyword` every external-metadata finding carries: no Ajv keyword
- * produced it.
- */
-declare const EXTERNAL_KEYWORD = "external";
-/** The join that names documents by path, and the default. */
-declare const PATH_JOIN = "path";
-/** One value a manifest supplied, and where it was written. */
-interface ExternalMetadataValue {
-    value: unknown;
-    /** The collection whose manifest supplied it (proposal 0041). */
-    collection: string;
-    /** Manifest path as the run reports it: relative to the run's base, posix — or the URL. */
-    file: string;
-    /** 1-based line of the key in the manifest, when known. */
-    line?: number;
-    /**
-     * 1-based manifest line of every node inside `value`, keyed by the JSON
-     * Pointer relative to `value` (`/2/source/file`). A mapping member sits on
-     * its key's line, and a list item on the line its node starts. Present only
-     * when `value` is a mapping or a list with members; `line` answers for the
-     * value itself.
-     */
-    lines?: ReadonlyMap<string, number>;
-}
-/** One manifest entry, for the orphan checks. */
-interface ExternalMetadataEntry {
-    /** The collection whose manifest declared it (proposal 0041). */
-    collection: string;
-    /** `path`, or the frontmatter field this entry is keyed by. */
-    join: string;
-    /** Absolute document path, for a path entry. */
-    abs?: string;
-    /** The key exactly as written in the manifest. */
-    spelled: string;
-    /** Manifest path as the run reports it. */
-    file: string;
-    /** 1-based line of the entry in the manifest, when known. */
-    line?: number;
-}
-/** Every manifest of a run, loaded once and consulted per document. */
-interface ExternalMetadataIndex {
-    /**
-     * Owned key -> every collection that owns it, with the manifest that does.
-     *
-     * A list rather than one entry, because two collections may legitimately
-     * each own the same key (0041 rule 5): `guides` and `blog` can both supply
-     * `owner`. Ambiguity only exists for a file that is a member of both, which
-     * is decided per file in `mergeExternalMetadata`.
-     */
-    owners: ReadonlyMap<string, readonly {
-        collection: string;
-        file: string;
-    }[]>;
-    /** Path-joined manifests: absolute document path -> owned key -> value. */
-    byPath: ReadonlyMap<string, ReadonlyMap<string, ExternalMetadataValue>>;
-    /** Field-joined manifests: field -> value -> owned key -> value. */
-    byField: ReadonlyMap<string, ReadonlyMap<string, ReadonlyMap<string, ExternalMetadataValue>>>;
-    /** Every manifest entry, in manifest order. */
-    entries: readonly ExternalMetadataEntry[];
-}
-interface LoadExternalMetadataOptions {
-    /** Directory `externalMetadata[].file` and every manifest key resolve from. */
-    configDir: string;
-    /** Directory the run's file labels are relative to; manifests are reported the same way. */
-    base: string;
-    /** `--offline` / `offline:`: a URL manifest is refused rather than fetched (0038). */
-    offline?: boolean;
-    /** Network timeout for a URL manifest; the schema fetch's default otherwise. */
-    timeoutMs?: number;
-    /** For tests: the environment `tokenEnv` is read from. */
-    env?: Record<string, string | undefined>;
-}
-/** A place a merged value lives, for a finding that must name it. */
-interface SourceLocation {
-    file: string;
-    line?: number;
-    col?: number;
-}
-/** A key the document carries that a manifest owns. */
-interface ExternalMetadataCollision {
-    key: string;
-    /** The owning manifest, as the run reports it. */
-    file: string;
-    /** The collection that manifest belongs to (proposal 0041). */
-    collection: string;
-}
-/** A field-joined entry a document matched (0039). */
-interface ExternalMetadataJoin {
-    field: string;
-    /** The value matched: the field's plaintext, decrypted first when the page holds it encrypted. */
-    value: string;
-    /**
-     * The field as the page holds it, when that differs from `value`: the
-     * ciphertext of an encrypted join field (proposal 0045). A finding about
-     * the join names this, never the plaintext.
-     */
-    pageValue?: string;
-    /** The manifest, as the run reports it. */
-    file: string;
-    /** The collection that manifest belongs to (proposal 0041). */
-    collection: string;
-}
-/** What `mergeExternalMetadata` hands back. */
-interface MergedMetadata {
-    /** The document's metadata with every owned key the manifest supplied. */
-    extracted: ExtractedMetadata;
-    /**
-     * Owned keys the document itself also carried, in document order, each
-     * with the manifest that owns it — so the finding names it without a
-     * second lookup, and without a fallback for an index that is not there.
-     */
-    collisions: ExternalMetadataCollision[];
-    /** Field-joined entries this document matched, one per manifest at most. */
-    joins: ExternalMetadataJoin[];
+    /** Diagnostics for the user; the CLI writes these to stderr. */
+    onNotice?: (message: string) => void;
+    /** Called once when a config governs the run, so the CLI can report it. */
+    onConfigLoaded?: (info: ConfigNotice) => void;
+    /** The clock an uncommitted body change is dated by. Test seam; default `new Date()`. */
+    now?: () => Date;
+    /** The review client, for every repository in the run. Test seam; default `gh` / `glab`. */
+    reviews?: ReviewClient;
     /**
-     * Where a merged pointer's value lives. Answers only for a value the
-     * manifest supplied — a bare key or its `/key` pointer, and anything
-     * beneath it — and `undefined` for everything the document owns, which is
-     * what `lineFor` is for.
-     *
-     * The line is the deepest manifest node the pointer reaches, so
-     * `/citations/2` is the third item's line and `/citations/2/source/file`
-     * that member's. A pointer past what the manifest holds falls back to the
-     * nearest ancestor that exists, and at worst to the owned key's line.
+     * How to ask for a new encryption key when a field its schema marks
+     * `x-manni-encrypt` is about to be stamped and no key is available
+     * (proposal 0045). The CLI passes `terminalConfirm()`, which is `undefined`
+     * off a terminal; absent, such a stamp refuses (exit 2). A dry run never
+     * asks: it writes nothing.
      */
-    locate: (pointer: string) => SourceLocation | undefined;
-}
-/** The join an external-metadata config asks for: `path` unless it names a field. */
-declare function externalMetadataJoin(manifest: Pick<ExternalMetadataConfig, "join">): string;
-/**
- * Load every manifest of every collection the run covers. Resolves to `null`
- * when none of them declares one, which is every setup that existed before
- * this feature.
- *
- * Every refusal is a `DocmetaError`: the manifest is a config-supplied input,
- * and one that is missing or misshapen is the run's problem, not a
- * document's (0014).
- */
-declare function loadExternalMetadata(collections: readonly CollectionConfig[], opts: LoadExternalMetadataOptions): Promise<ExternalMetadataIndex | null>;
-/**
- * Merge the external metadata for one document into its extracted metadata.
- *
- * `label` is the document as the run spells it, relative to `base`; a path
- * entry matches on the resolved absolute path, never on the spelling, so a
- * positional run from a subdirectory finds the same entry a config-corpus
- * run does. A field entry matches on the document's own value of the join
- * field, wherever the document lives. Stdin never matches a path entry:
- * there is no file behind it.
- *
- * `memberOf` names the collections this document belongs to, and only their
- * manifests are consulted (0041 rule 4). It is the caller's `memberOf(...)`
- * result, computed once per file.
- *
- * `present`, `format` and the document's own positions are untouched. A
- * manifest key is not in the document, so `lineFor` keeps answering
- * `undefined` for it, and `locate` answers instead.
- *
- * A join field the page holds encrypted (proposal 0045) is decrypted with
- * `options.encryptionKey` before it is matched. With no key, and a manifest
- * of this document's collections joining on that field, the run cannot match
- * and refuses. A ciphertext that does not decrypt matches nothing.
- */
-declare function mergeExternalMetadata(label: string, extracted: ExtractedMetadata, index: ExternalMetadataIndex | null, memberOf: readonly string[], base: string, options?: {
-    encryptionKey?: () => string | undefined;
-}): MergedMetadata;
-/** The `/key` pointer for an external-metadata finding, RFC 6901 escaped. */
-declare function externalMetadataPointer(key: string): string;
-/**
- * Path entries naming no loaded document.
- *
- * `loaded` are the run's file labels, relative to `base`. Checked only when
- * the run is the config corpus (the same invariant corpus checks use): a
- * positional path means the operator chose to look at part of the corpus,
- * and an entry for the rest is expected, not orphaned.
- */
-declare function orphanEntries(index: ExternalMetadataIndex | null, loaded: readonly string[], base: string, collections?: readonly string[]): ExternalMetadataEntry[];
-/**
- * Field entries no loaded document matched (0039). `matched` is field -> the
- * values documents in the run carried, which the caller collects from each
- * document's `joins` — so this runs after the per-file loop, under the same
- * corpus invariant as `orphanEntries`.
- */
-declare function orphanJoins(index: ExternalMetadataIndex | null, matched: ReadonlyMap<string, ReadonlySet<string>>, collections?: readonly string[]): ExternalMetadataEntry[];
-/** The operational error an orphan check raises, naming the first entry. */
-declare function orphanError(orphans: readonly ExternalMetadataEntry[]): DocmetaError;
-
-declare class Validator {
-    private readonly schemaOptions;
+    confirm?: Confirm;
     /**
-     * How this validator's schemas are loaded: the disk cache location, its TTL,
-     * and `--offline`. Held per instance rather than read from module state, so
-     * two differently-configured validations in one process each get their own
-     * settings.
-     *
-     * That is not full isolation, and the difference matters to a library
-     * caller: `schema-registry` keeps a process-wide memo of fetched schemas, so
-     * one validator's successful fetch is visible to another. `offline` is
-     * excluded from that sharing on purpose — an offline validator will not be
-     * served something this process pulled over the network — but the memo is
-     * still shared, so a URL fetched once is not re-fetched per instance.
+     * The environment `MANNI_ENCRYPTION_KEY` is read from. Defaults to
+     * `process.env`; tests pass their own.
      */
-    constructor(schemaOptions?: LoadSchemaOptions);
-    private ajvByDialect;
+    env?: NodeJS.ProcessEnv;
     /**
-     * Keyed on the in-flight *promise*, not the resolved validator. Caching the
-     * result made this a check-then-act race: `fill` walks files through a worker
-     * pool, so every worker missed the cache while the first `loadSchema` was
-     * still pending and they all then compiled the same schema into the one
-     * shared per-dialect Ajv. Ajv registers a schema's `$id` on the first compile
-     * and rejects the second with "schema with key or id ... already exists",
-     * which took down any multi-file run against an $id-bearing schema. Storing
-     * the promise before the first await lets the losers await the one compile.
+     * `--generated-by <name>` (proposal 0046): the machine uncommitted body
+     * lines go to, or the lines a `<path>:L1-L2` positional names. Absent reads
+     * `MANNI_GENERATED_BY` from `env`; an empty value is unset either way.
      */
-    private cache;
-    private ajvFor;
+    generatedBy?: string;
     /**
-     * Synchronous by design: the `cache.set` has to happen in the same tick as
-     * the miss, or a second caller can slip in before the entry exists.
+     * Called with relocate's result after the user accepts a P1 offer
+     * (proposal 0047), so the CLI can print what moved before the report.
      */
-    private compile;
-    private compileUncached;
+    onRelocated?: (result: RelocateResult) => void;
+}
+interface DeriveFileResult {
+    file: string;
+    /** Extractor/format used; `unknown` when none matched the file. */
+    format: string;
+    /** One entry per requested field, in the requested order. Empty on `error`. */
+    fields: DerivedField[];
     /**
-     * The instance pointers of `data` that carry `x-manni-encrypt: true` under
-     * any schema in `refs`, in the order the validator evaluated them.
-     *
-     * A first pass with the recording keyword, so a mark counts exactly where
-     * validation would evaluate it. Only present values are marked: Ajv applies
-     * a property's subschema to a property that exists. A branch Ajv does not
-     * take (`then` behind a failing `if`, an `anyOf` branch after a passing
-     * one) contributes nothing; a branch it takes contributes its marks
-     * whether or not the branch passes, because a ciphertext routinely fails
-     * the rest of its own subschema until it is decrypted.
+     * Whether writing the stale and unset fields changed the document, or
+     * would have but for `dryRun`. Computed from the writer's output, so a
+     * patch the format serializes to the same bytes is not a change.
      */
-    markedPointers(data: Record<string, unknown>, refs: string[]): Promise<Set<string>>;
+    changed: boolean;
+    /** Why the file could not be derived or written; the run goes on without it. */
+    error?: string;
     /**
-     * Validate `data` against every schema in `refs`. Returns all violations,
-     * each tagged with the schema that produced it and a source line via
-     * `lineFor`.
-     *
-     * `colFor` is optional and additive: this signature is public, so a fourth
-     * *required* parameter — or a widened third one — would be a consumer break.
-     * Callers with an extractor that supplies no column pass nothing and get the
-     * previous behavior exactly.
+     * Under `check`, the findings for this file: one per stale or unset field,
+     * at the field's line, plus one for an `error`. Absent otherwise.
      */
-    validate(data: Record<string, unknown>, refs: string[], lineFor: (pointer: string) => number | undefined, colFor?: (pointer: string) => number | undefined, 
+    findings?: FieldError[];
+}
+interface DeriveSummary {
+    files: number;
+    /** Files whose document changed, or would have under `dryRun`. */
+    changed: number;
+    /** Fields whose write reached the disk: always 0 under `dryRun` and `check`. */
+    written: number;
     /**
-     * Where a merged value lives when it is not in the document (proposal
-     * 0037): a manifest's file and line. Consulted before `lineFor`,
-     * and additive in the way `colFor` was.
+     * `provenance` ranges whose write reached the disk (proposal 0046): always
+     * 0 under `dryRun` and `check`. Present only when the run derives
+     * `provenance`.
      */
-    locate?: (pointer: string) => SourceLocation | undefined): Promise<FieldError[]>;
+    ranges?: number;
+    stale: number;
+    unset: number;
+    unknown: number;
+    errors: number;
+}
+interface DeriveRun {
+    results: DeriveFileResult[];
+    summary: DeriveSummary;
+    dryRun: boolean;
+    check: boolean;
+    /** One status per source the run consulted; a source nobody asked for is absent. */
+    sources: Partial<Record<DeriveSource, SourceStatus$1>>;
+    /** Where the run stood, for the SARIF reporter under `check`. See `ValidateRun.frame`. */
+    frame: FingerprintContext;
+}
+declare function runDerive(opts: DeriveOptions): Promise<DeriveRun>;
+
+/**
+ * `relocate` (proposal 0047): move every value to where its schema's
+ * `x-manni-location` mark and the config's manifests say it belongs.
+ *
+ * Out of the page and into a manifest go the values a schema prefers in
+ * external metadata and the values a manifest already owns. Out of a manifest
+ * and into the page go the values a schema prefers on the page. The
+ * collection, manifest file and config entry a value needs are created on the
+ * way, and a change to a manifest's `keys:` covers every member page of its
+ * collection. The planning and writing live in `core/relocation.ts`, which the
+ * writers' and validate's offers share; this is the command around it.
+ *
+ * Two refusals come before the config is read, because each rules out the
+ * whole run: stdin, which is not a document a manifest can name, and
+ * `--no-config`, which leaves nowhere to declare a manifest.
+ */
+
+interface RelocateOptions {
+    /** Files, directories and globs. Empty falls back to the configured collections. `-` is refused. */
+    inputs: string[];
+    /** `--fields`: only these keys. Each must carry a mark, or be manifest-owned, for some file. */
+    fields?: string[];
+    /** `--collection <name>`, repeatable: run over these configured collections. */
+    collections?: string[];
+    /** `-s/--schema`, repeatable: the schema set every page is judged by. */
+    cliSchemas?: string[];
+    /** `--dry-run`: report what would move and be created; write nothing. */
+    dryRun?: boolean;
+    /** `--as`: force an extractor. */
+    as?: string;
+    exts?: string[];
+    exclude?: string[];
+    configPath?: string;
+    /** `--no-config`: refused, since relocate writes the config. */
+    noConfig?: boolean;
+    cwd?: string;
+    allowEmpty?: boolean;
+    /** `--no-gitignore` (false). Absent leaves config `respectGitignore:` in charge. */
+    respectGitignore?: boolean;
+    onNotice?: (message: string) => void;
+    onConfigLoaded?: (info: ConfigNotice) => void;
+    /** Where `MANNI_ENCRYPTION_KEY` is read, for an encrypted join field. Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
 }
+declare function runRelocate(opts: RelocateOptions): Promise<RelocateResult>;
 
 /** One value re-encrypted: where, and the ciphertext before and after. */
 interface ReencryptedValue {
@@ -2297,6 +2746,12 @@ interface DeriveResult {
      * not point at. Absent means not applicable here, never unavailable.
      */
     sources: Partial<Record<DeriveSource, SourceStatus$1>>;
+    /**
+     * The provenance derivation per input label (proposal 0046), for the
+     * comparison with a page's stamp: present only when `provenance` was
+     * requested and the git source answered.
+     */
+    provenance?: ReadonlyMap<string, ProvenanceDerivation>;
 }
 /**
  * Which sources can state a field, in precedence order: the built-in table
@@ -3008,8 +3463,7 @@ interface SourceRange {
     start?: number;
     end?: number;
 }
-/** Lines as an entry writes them: an integer for one line, `"L1-L2"` for several. */
-type LineSpec = number | string;
+
 /** The page text a citation supports. */
 interface CitationClaim {
     /** Body lines: counted from the first line after the frontmatter. Absent when a marker anchors the entry. */
@@ -3028,7 +3482,7 @@ interface CitationSource {
     /** The git commit hash the pin was taken at: 7 to 64 lowercase hex. */
     "commit-sha"?: string;
 }
-/** One entry of `citations`, as the schema (`manni:citations:1.0.0-proposal.3`) spells it. */
+/** One entry of `citations`, as the schema (`manni:citations:1.0.0-proposal.4`) spells it. */
 interface Citation {
     id?: string;
     claim?: CitationClaim;
@@ -3344,11 +3798,6 @@ interface CheckRun {
     warnings: number;
     notices: number;
 }
-/** Page lines as an editor numbers them, 1-based and inclusive. */
-interface PageLines {
-    start: number;
-    end: number;
-}
 interface AddOptions {
     page: string;
     /** The claim's lines as an editor numbers them (`page:L`, `page:L1-L2`). Absent: a bare pin. */
@@ -3596,16 +4045,6 @@ declare const SRC_PATTERN: RegExp;
 declare function parseSrc(src: string): SourceRange;
 /** The canonical spelling: `path:L` for one line, `path:L1-L2` otherwise. */
 declare function formatSrc(range: SourceRange): string;
-/**
- * The lines an entry's `lines` names. Undefined for a value that is neither
- * a positive integer nor `"L1-L2"` with `L1 <= L2`: the schema refuses the
- * first, and `readPage` reports the second.
- */
-declare function parseLines(spec: LineSpec): PageLines | undefined;
-/** Lines as an entry writes them: the integer for one line, `"L1-L2"` otherwise. */
-declare function lineSpec(lines: PageLines): LineSpec;
-/** Lines as a report spells them: `"9"` or `"9-12"`. */
-declare function spellLines(lines: PageLines): string;
 /** An entry's source as a range. Its lines must already be valid (see `parseLines`). */
 declare function sourceRange(source: CitationSource): SourceRange;
 /** An entry's source spelled as one string, `path:L1-L2`, the way the command line takes it. */
@@ -3613,31 +4052,19 @@ declare function spellSource(source: CitationSource): string;
 /** A range's lines as an entry writes them; undefined for a whole file. */
 declare function rangeLines(range: SourceRange): LineSpec | undefined;
 
-/** BOM stripped, CRLF folded to LF. */
-declare function normalizeText(text: string): string;
-/** The normalized lines, without the empty element a trailing LF leaves. */
-declare function splitLines(text: string): string[];
 /**
- * The cited lines joined by LF. Throws `CiteError` when the range runs past
- * the end of the text (`<path> has N lines; line M is out of range`).
+ * The hashing rule, as cite uses it. The engine is `src/shared/pin.ts`, shared
+ * with meta; this module keeps cite's import path and its error contract: a
+ * range past the end of the text throws `CiteError`.
  */
-declare function sliceLines(lines: readonly string[], range?: {
-    start?: number;
-    end?: number;
-}, label?: string): string;
-/** The pin of the cited lines: plain, or the keyed pin under `key` when one is given. */
-declare function hashRange(text: string, range?: {
-    start?: number;
-    end?: number;
-}, key?: string): string;
+
 /**
- * The pin of already-joined lines: `sha256-<hex>`, or with `key` the
- * `hmac-sha256-<hex>` keyed pin an encrypted source carries. A plain pin
- * passes `undefined`.
+ * The cited lines joined by LF. Throws `CiteError` when the range runs past
+ * the end of the text (`<path> has N lines; line M is out of range`).
  */
-declare function hashLines(joined: string, key?: string): string;
-/** Whether a pin is keyed (`hmac-sha256-`), the form an encrypted source carries. */
-declare function isKeyedPin(pin: string): boolean;
+declare function sliceLines(lines: readonly string[], range?: LineRange, label?: string): string;
+/** The pin of the cited lines: plain, or the keyed pin under `key` when one is given. Throws `CiteError` past the end. */
+declare function hashRange(text: string, range?: LineRange, key?: string): string;
 
 /**
  * How a citation reads on a terminal. A pin is sixty-four hex digits and a
@@ -3801,12 +4228,6 @@ declare function offsetOfLine(content: string, line: number): number;
 declare function normalizeWhitespace(text: string): string;
 /** `true` when the block's normalized text equals the cited lines under the hashing rule. */
 declare function blockMatches(blockText: string, citedJoined: string): boolean;
-/** Body lines as file lines: body line 1 is the first line after the frontmatter. */
-declare function toFileLines(lines: PageLines, bodyLine: number): PageLines;
-/** File lines as body lines. */
-declare function toBodyLines(lines: PageLines, bodyLine: number): PageLines;
-/** The pin of a page range, under the claim rule: always plain. */
-declare function pinOfLines(lines: readonly string[], range: PageLines): string | undefined;
 /** The first file line of a classified claim: where its findings sit. */
 declare function claimLine(claim: ClaimEnd): number | undefined;
 /**
@@ -3877,9 +4298,6 @@ declare function noGit(): GitClient;
  * `moved`, not `never-true`; the search sees the file as it is.
  */
 
-declare const MOVE_WINDOW_LINES = 2000;
-declare const MOVE_BUDGET_BYTES: number;
-declare const MAX_RANGE_LINES = 5000;
 interface ClassifyOptions {
     root: string;
     index: SourceIndex;
@@ -3890,24 +4308,6 @@ interface ClassifyOptions {
     /** Hashing budget for the blind move search, in bytes. Default `MOVE_BUDGET_BYTES`. */
     budget?: number;
 }
-interface FindWindowsOptions {
-    /** The 1-based start line the range was pinned at: the blind search begins around it. */
-    around?: number;
-    /** The cited lines at the commit, when git could show them: enables the first-line filter. */
-    original?: readonly string[];
-    /** Hashing budget for the blind search, in bytes. Default `MOVE_BUDGET_BYTES`. */
-    budget?: number;
-}
-/**
- * Pure move search over normalized lines: the 1-based start lines where a
- * window of `length` lines hashes to `pin`. `original` (the cited lines at the
- * commit, when known) enables the first-line filter. `key` keys the hash for
- * an encrypted source's pin and is `undefined` for a plain one.
- */
-declare function findWindows(lines: readonly string[], length: number, pin: string, key: string | undefined, opts?: FindWindowsOptions): {
-    starts: number[];
-    truncated: boolean;
-};
 /**
  * What git could say about the pin at the recorded commit. `unknown` is a
  * file at the commit too large to search under the budget with the pin found
@@ -4804,4 +5204,4 @@ declare namespace index {
   export { type index_EncryptionContext as EncryptionContext, index_KeyError as KeyError, type index_KeyRotateOptions as KeyRotateOptions, type index_KeyRotateResult as KeyRotateResult, type index_KeySetOptions as KeySetOptions, type index_KeySetResult as KeySetResult, type index_KeySource as KeySource, type index_ResolvedKey as ResolvedKey, type index_RotateManifest as RotateManifest, type index_RotateOutcome as RotateOutcome, type index_RotatePage as RotatePage, type index_RotatedCitation as RotatedCitation, type index_RotatedManifestValue as RotatedManifestValue, type index_RotatedMetadata as RotatedMetadata, type index_RotatedValue as RotatedValue, type index_SkippedCitation as SkippedCitation, type index_SkippedManifestValue as SkippedManifestValue, type index_SkippedMetadata as SkippedMetadata, type index_SkippedValue as SkippedValue, index_decryptValue as decryptValue, index_encryptValue as encryptValue, index_isEncryptedValue as isEncryptedValue, index_resolveEncryptionKey as resolveEncryptionKey, index_runKeyRotate as runKeyRotate, index_runKeySet as runKeySet };
 }
 
-export { type ApplyOptions, type Approval, type BaselineSummary, BinMissing, type BuiltinDerivableField, COMMON_FORMATS, type CheckConfig, type CollectionConfig, type CommandSourceOptions, type CommandSourceResult, type CommonFormat, type ConfigNotice, DEFAULT_SCHEMAS, DEFAULT_TTL_HOURS, DEFAULT_VENDOR_DIR, DERIVABLE_FIELDS, DERIVED_KEYWORD, DERIVED_STALE_SCHEMA, DERIVE_FORMATS, DERIVE_SOURCES, type DerivableField, type DeriveCommand, type DeriveCommandConfig, type DeriveConfig, type DeriveContext, type DeriveFileResult, type DeriveInput, type DeriveOptions, type DeriveReportFormat, type DeriveReportOptions, type DeriveResult, type DeriveRun, type DeriveSource, type DeriveSummary, type DerivedField, type DerivedRecord, type DerivedStatus, type DerivedValue, type DocmetaConfig, DocmetaError, type DocumentRefTrust, EXTERNAL_DUPLICATE_SCHEMA, EXTERNAL_KEYWORD, EXTERNAL_METADATA_FETCH_MAX_BYTES, EXTERNAL_METADATA_FETCH_TIMEOUT_MS, EXTERNAL_OWNED_SCHEMA, type ExternalMetadataCollision, type ExternalMetadataConfig, type ExternalMetadataEntry, type ExternalMetadataFetchOptions, type ExternalMetadataIndex, type ExternalMetadataJoin, type ExternalMetadataValue, type ExtractOptions, type ExtractedMetadata, FIELD_SOURCES, FILL_FORMATS, type FetchedSchema, type FieldError, type FillConfig, type FillFileResult, type FillOptions, type FillReportFormat, type FillReportOptions, type FillRun, type FillSummary, type FilledField, type FingerprintContext, type FrontmatterFlavor, type FrontmatterLocation, type GetFileResult, type GetOptions, type GetReportOptions, GitHubClient, GitLabClient, INTEGRITY_SHAPE, type JunitOptions, type LoadExternalMetadataOptions, type LoadSchemaOptions, type LoadedConfig, type MergedChange, type MergedMetadata, type MetadataExtractor, type MetadataPatch, PATH_JOIN, PATH_PLACEHOLDER, QUERY_FORMATS, type QueryChange, type QueryFormat, type QueryOptions, type QueryReportOptions, type QueryRun, REPORT_FORMATS, RESOLVED_VIEW, REVIEW_CACHE_DIR, REVIEW_CACHE_VERSION, type ReadOptions, type ReencryptMetadataResult, type ReencryptedValue, type RemoteIdentity, type ReportFormat, type ReportOptions, ReviewCache, type ReviewClient, type ReviewFacts, type ReviewSourceInput, type ReviewSourceResult, type Run, type RunConfig, type RunConfigOptions, type RunSummary, SCHEMA_CACHE_DIR, SCHEMA_CACHE_VERSION, type SarifOptions, SchemaCache, type SchemaCacheConfig, type SchemaCacheEntry, type SchemaEntry, type SchemaPin, type SchemaRefEntry, type SchemaTrustConfig, type SkipReason, type SourceLocation, type SourceStatus$1 as SourceStatus, type SpawnOptions, type ValidateOptions, type ValidateRun, type ValidationResult, Validator, type VendorOptions, type VendorResult, applyFrontmatter, argvFor, assertSourcesAvailable, cachedClient, index$1 as cite, classifyRef, collectSchemaPins, compareDerived, consultedSources, createResolvedView, createReviewClient, deriveFromCommands, deriveFromReviews, deriveMetadata, externalMetadataJoin, externalMetadataPointer, externalMetadataUrlProblem, extractFrontmatter, extractorForExtension, fetchExternalMetadata, fetchSchemaBytes, frontmatterInnerText, getSchemasInfo, identityFromOrigin, integrityOf, isBuiltinField, isCommonFormat, isDeriveFormat, isDeriveSource, isErrorSeverity, isFillFormat, isIntegrity, isMember, isPerFile, isQueryFormat, isReportFormat, index as key, listBuiltins, loadConfig, loadExternalMetadata, loadSchema, locateFrontmatter, memberOf, mentionsResolved, mergeExternalMetadata, orphanEntries, orphanError, orphanJoins, parseCollections, parseConfig, parseOriginUrl, rebaseConfigSchemaRefs, reencryptMetadata, render, renderDerive, renderFill, renderFillGithub, renderGet, renderJunit, renderQuery, renderQueryCsv, renderSarif, resolveRunConfig, resolveSchemaSet, resolvedColumns, run, runDerive, runFill, runGet, runQuery, runValidate, runVendorSchema, schemaCacheDir, schemaEntryRef, schemaLoadOptions, selectCollections, sourcesFor, staleFindings, stringifyValue, supportedExtensions, valueOf, vendorFileName, writeFileAtomic };
+export { type ApplyOptions, type Approval, type BaselineSummary, BinMissing, type BuiltinDerivableField, COMMON_FORMATS, type CheckConfig, type CollectionConfig, type CommandSourceOptions, type CommandSourceResult, type CommonFormat, type ConfigNotice, DEFAULT_SCHEMAS, DEFAULT_TTL_HOURS, DEFAULT_VENDOR_DIR, DERIVABLE_FIELDS, DERIVED_KEYWORD, DERIVED_STALE_SCHEMA, DERIVE_FORMATS, DERIVE_SOURCES, type DerivableField, type DeriveCommand, type DeriveCommandConfig, type DeriveConfig, type DeriveContext, type DeriveFileResult, type DeriveInput, type DeriveOptions, type DeriveReportFormat, type DeriveReportOptions, type DeriveResult, type DeriveRun, type DeriveSource, type DeriveSummary, type DerivedField, type DerivedRecord, type DerivedStatus, type DerivedValue, type DocmetaConfig, DocmetaError, type DocumentRefTrust, EXTERNAL_DUPLICATE_SCHEMA, EXTERNAL_KEYWORD, EXTERNAL_METADATA_FETCH_MAX_BYTES, EXTERNAL_METADATA_FETCH_TIMEOUT_MS, EXTERNAL_OWNED_SCHEMA, type ExternalMetadataCollision, type ExternalMetadataConfig, type ExternalMetadataEntry, type ExternalMetadataFetchOptions, type ExternalMetadataIndex, type ExternalMetadataJoin, type ExternalMetadataValue, type ExtractOptions, type ExtractedMetadata, FIELD_SOURCES, FILL_FORMATS, type FetchedSchema, type FieldError, type FieldLocation, type FillConfig, type FillFileResult, type FillOptions, type FillReportFormat, type FillReportOptions, type FillRun, type FillSummary, type FilledField, type FingerprintContext, type FrontmatterFlavor, type FrontmatterLocation, type GetFileResult, type GetOptions, type GetReportOptions, GitHubClient, GitLabClient, INTEGRITY_SHAPE, type JunitOptions, LOCATION_KEYWORD, type LoadExternalMetadataOptions, type LoadSchemaOptions, type LoadedConfig, type LocationPreference, type MergedChange, type MergedMetadata, type MetadataExtractor, type MetadataPatch, PATH_JOIN, PATH_PLACEHOLDER, QUERY_FORMATS, type QueryChange, type QueryFormat, type QueryOptions, type QueryReportOptions, type QueryRun, REPORT_FORMATS, RESOLVED_VIEW, REVIEW_CACHE_DIR, REVIEW_CACHE_VERSION, type ReadOptions, type ReencryptMetadataResult, type ReencryptedValue, type RelocateOptions, type RelocateResult, type RemoteIdentity, type ReportFormat, type ReportOptions, ReviewCache, type ReviewClient, type ReviewFacts, type ReviewSourceInput, type ReviewSourceResult, type Run, type RunConfig, type RunConfigOptions, type RunSummary, SCHEMA_CACHE_DIR, SCHEMA_CACHE_VERSION, type SarifOptions, SchemaCache, type SchemaCacheConfig, type SchemaCacheEntry, type SchemaEntry, type SchemaPin, type SchemaRefEntry, type SchemaTrustConfig, type SkipReason, type SourceLocation, type SourceStatus$1 as SourceStatus, type SpawnOptions, type ValidateOptions, type ValidateRun, type ValidationResult, Validator, type VendorOptions, type VendorResult, applyFrontmatter, argvFor, assertSourcesAvailable, cachedClient, index$1 as cite, classifyRef, collectSchemaPins, compareDerived, consultedSources, createResolvedView, createReviewClient, deriveFromCommands, deriveFromReviews, deriveMetadata, externalMetadataJoin, externalMetadataPointer, externalMetadataUrlProblem, extractFrontmatter, extractorForExtension, fetchExternalMetadata, fetchSchemaBytes, frontmatterInnerText, getSchemasInfo, identityFromOrigin, integrityOf, isBuiltinField, isCommonFormat, isDeriveFormat, isDeriveSource, isErrorSeverity, isFillFormat, isIntegrity, isMember, isPerFile, isQueryFormat, isReportFormat, index as key, listBuiltins, loadConfig, loadExternalMetadata, loadSchema, locateFrontmatter, memberOf, mentionsResolved, mergeExternalMetadata, orphanEntries, orphanError, orphanJoins, parseCollections, parseConfig, parseOriginUrl, rebaseConfigSchemaRefs, reencryptMetadata, render, renderDerive, renderFill, renderFillGithub, renderGet, renderJunit, renderQuery, renderQueryCsv, renderSarif, resolveRunConfig, resolveSchemaSet, resolvedColumns, run, runDerive, runFill, runGet, runQuery, runRelocate, runValidate, runVendorSchema, schemaCacheDir, schemaEntryRef, schemaLoadOptions, selectCollections, sourcesFor, staleFindings, stringifyValue, supportedExtensions, valueOf, vendorFileName, writeFileAtomic };